The vulnerability in the Quiz and Survey Master plugin results from missing capability and status checks on several functions. This oversight allows any visitor, including unauthenticated users, to retrieve full details of unpublished, private, or password‑protected quizzes and to submit arbitrary file responses to quiz questions. The exposed quiz content and the ability to upload files can lead to data disclosure and potential malicious payload delivery.

The issue affects all installations of ExpressTech’s Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker from version 10.3.1 backward. Any WordPress site that has the plugin enabled and has not applied the latest patch is vulnerable. The problem is confined to the plugin within the WordPress environment; no other WordPress components are directly impacted.

The CVSS v3.1 base score of 6.5 reflects a moderate level of severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not catalogued in the CISA KEV. Attackers can likely exploit the flaw by requesting quiz data or uploading files through the plugin’s publicly reachable endpoints, as no authorization is enforced. Successful exploitation would compromise the confidentiality of quiz content and could allow the storage of malicious files on the server, presenting integrity and resource‑exhaustion risks.